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Abstract. A pattern-based approach to the presentation, codification 
Pj , and reuse of property specifications for finite-state verification was pro- 

^ ' posed by Dwyer and his colleagues in Mp]. The patterns enable non- 

experts to read and write formal specifications for realistic systems and 
^^ . facilitate easy conversion of specifications between formalisms, such as 

C^ ' LTL, CTL, QRE. In this paper we extend the pattern system with events 

— changes of values of variables in the context of LTL. 
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1 Introduction 



Temporal logics (TL) (e.g., [0, [|, §, ||l|l, (T|) have received a lot of attention 
in the research community. Not only are they useful for specifying properties of 
systems, recent advances in model-checking allow effective automatic checking 
of models of systems against such properties, e.g. using tools like SPIN g| and 
SMV H. 
^3 ' Oiic important obstacle to using temporal logic is the ability to express com- 

^^ I plex properties correctly. To remedy this problem, Dwyer and his colleagues have 

^^ ' proposed a pattern-based approach to the presentation, codification and reuse of 

property specifications. The system allows patterns like "P is absent between Q 
and S" or "5* precedes P between Q and i?" to be easily expressed in and trans- 
lated between linear-time temporal logic (LTL) Jll|, computational tree logic 
(CTL) Q, quantified regular expressions (QRE) |15( |, and other state-based and 
event-based formalisms. Dwyer et. al. also performed a large-scale study in which 
specifications containing over 500 temporal properties were collected and ana- 



H I lyzed. They noticed that over 90% of these could be classified under one of the 

- proposed patterns ^K 

In earlier work |20|, we used the Promcla/SPIN framework to model the 
Production Cell system. We attempted to use the pattern-base approach to 
help us formalize properties of this system in LTL. However, we found that the 
approach could not be applied directly, because our properties used events — 
changes of values of variables, e.g., "magnet should become deactivated", which 
we wanted to formalize as "magnet is active now and will be inactive in the next 
state" . We called such events edges. 

LTL is a temporal logic comprised of prepositional formulas and temporal 
connectives □ ("always"), O ("eventually"), o ("next"), and W ("until"). The 
first three operators are unary, while the last one is binary. U is the strong 
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Fig. 1. A Pattern Hierarchy. 



until; that is, it requires that B actually happen sometime in the future. In this 
context, we define edges as follows: 

1"A ^= -^A A oA — up or rising edge 
lA ^ A A 0-1 A — down or falling edge 
|A = t A V jA ~ any edge 

LTL formulas containing events may have problems caused by the use of the 
"next" operator in the definition of edges. Temporal formulas that make use 
of "next" may not be closed under stuttering, i.e. their interpretation may be 
modified by transitions that leave the system in the same state ("stutter"). As 
we discuss later in the paper, this is an essential property for effective use of 
temporal formulas. 

Model-checking allows relatively novice users to verify correctness of their 
systems quickly and effectively. However, it is essential that these users are able 
to specify correctness criteria in the appropriate temporal logic. For example, 
effective use of SPIN Q depends critically on being able to express such criteria 
in LTL. Under the presence of events, it is often quite complex (see [^ for a 
thorough discussion). In this paper we extend the properties of Dwyer et. al. to 
include events in LTL properties. The rest of the paper is organized as follows: 
Section pi overviews the pattern-based system. Section presents our extension to 
the pattern-based system and discusses the extension process. Section ^ contains 
an informal summary of our treatment of closure under stuttering and presents 
a set of theorems that allow syntactic checking of formulas for this property. In 
addition, it shows how to use these theorems to prove that our extensions of the 
pattern-based system are closed under stuttering. Section g concludes the paper. 

2 Overview of the Pattern-Based Approach 

In this section we survey the pattern-based approach. For more information, 
please refer to ^j^- The patterns are organized hierarchically based on their 
semantics, as illustrated in Figure |[ Some of the patterns are described below: 

Absence A condition does not occur within a scope; 

Existence A condition must occur within a scope; 



Universality A condition occurs throughout a scope; 

Response A condition must always be followed by another within a scope; 

Precedence A condition must always be preceded by another within a scope. 

Each pattern is associated with several scopes — the regions of interest over 
which the condition is evaluated. There are five basic kinds of scopes: 

A. Global The entire state sequence; 

B. Before R The state sequence up to condition R; 

C. After Q The state sequence after condition Q; 

D. Between Q and R The part of the state sequence between condition Q and 
condition R; 

E. After Q Until R Similar to the previous one, except that the designated 
part of the state sequence continues even if the second condition does not 
occur. 

These scopes are depicted in Figure || The scopes were initially defined in [Q 
to be closed-left, open-right intervals, although it is also possible to define other 
combinations, such as open-left, closed-right intervals. 
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Fig. 2. Pattern Scopes. 



For example, an LTL formulation of the property "S* precedes P between Q 
and i?" (Precedence pattern with "between Q and i?" scope) is: 



n((Q A OR) ^ {^P U{Sy R))) 

Even though the pattern system is formalism-independent |^ 
are only concerned with the expression of properties in LTL. 
S 



in this paper we 



3 Edges and the Pattern-Based System 

LTL is a state-based formalism, and thus the original pattern system does not 
specify the expression of events in LTL. In this section we show how to include 



reasoning about events to the pattern system. These events can be used for 
specifying conditions as weU as for defining the bounding scopes. 

We start by introducing some notation that aUows us a more compact rep- 
resentation of properties. We define the weak version of "until" as: 

AWB ^nAV {AU B) 

That is, we no longer require B to happen in the future; if it does not, than A 
should hold indefinitely. Another useful operator is "precedes" : 

AV B :^ ^{^AU B) 

That is, we want A to hold before B does. Note that in this case B may never 
happen. Also, we use y < x [> z to indicate if x then y else z, or {xAy)\/{^x/\z). 
Finally, we write T and _L to indicate boolean values true and false, respectively. 
Since our extension involves edges, we give a few relevant properties below: 

a]- A = ± (1) 

□ jA = ± (2) 

lAUB = By i^AAoB) (3) 

Properties (|l|) and (0) indicate that edges of the same type cannot occur in every 
state of the system, whereas property (0) allows us to replace an "until" with a 
propositional expression. 

We have explored the concept of edges in |19,na, and list some of edge 
properties in the Appendix. 

3.1 Extending the Pattern System 

Introducing edges into the patterns generates an explosion in the number of 
formulas: conditions can be state-based or edge-based, inclusive or exclusive, 
and the interval ends can be either opened or closed. Our extension does not 
include all the possibilities, but rather a significant and representative set of 
them, as discussed below. 

We were able to extend five of the nine patterns: Absence (Figure 0), Exis- 
tence (Figure 0), UniversaUty (Figured), Response (Figured), Precedence 
(Figure ^. For each of the five scopes, we list four formulas corresponding to the 
four combinations of state-based and edge-based conditions and interval bounds 
we have considered: 



0. P, S — states, Q, R — states; 

1. P, S — states, Q, R — up edges; 

2. P, S — up edges, Q, R — states; 

3. P, S — up edges, Q, R — up edg 



up edges. 

Combination corresponds to the original formulation of p] , where all of P, S, 
Q and R are state-based. The remaining three combinations are our extensions 



A. Globally 

0. a^P 

1. a^P 

2. D^tP 

3. D^tP 



B. Before R 

0. OR^ {-^PUR) 

1. 0]R^ {]RP P) 

2. OR^{-^]PUR) 

3. Oji?^ (^TPWTi?) 



C. After Q 

0. nCQ^ D^P) 

1. n(tQ^on^P) 

2. 0(0 ^ D^TP) 

3. □(TQ ^ D^T-P) 



D. Between Q and P 

0. D((gAOP) ^ {-npu R)) 

1. D((tQ A otP A ^T^) ^ °(T-R T' -P)) 

2. D((QAOP) ^ i^lPKR)) 

3. □((TO A OTP) ^ (--TP w TP)) 



E. After Q Until P 

0. □((QAOP) ^{-nPUR)) 

1. □((TO A -^IR A OOP) =^ o(TP P P)) 

2. □(O^ (^TP'WP)) 

3. □(TO^ (^T^vvT^)) 



Fig. 3. Formulations of the Absence Pattern 



A. Globally 

0. OP 

1. OP 

2. OTP 

3. OTP 



B. Before P 

0. OP^ (PPR) 

1. OTP^ (^T-RWP) 

2. OP^ (TPPP) 

3. OTP^ (TPPT^) 



D. Between Q and P 

0. □((Q A OP) => ((P P P) A ^P)) 0. □(Q = 

1. □((TOAOTP)^ (o(^T^WP) A^T-R)) 1- D(TO 

2. □((Q A OP) ^ ((TP P P) A ^P)) 2. □(Q = 

3. □((TO A OTP) ^ HIP V TP) A ^T^)) 3. □(TO 



C. After 

0. 00^0(0 A OP) 

1. OTQ^o(TOAoOP) 

2. 00^0(0 A OTP) 

3. OTQ =^ o(T0 A OTP) 

E. After Q Until P 
(PP R)A^R<ORi> OP) 
^o{-n'[RUP)A^]'R) 
(IP P P) A -.P < OP > OTP) 

» (TP V TP) A ^T^ < OT^ > OTt 



Fig. 4. Formulations of the Existence Pattern 



to the pattern system. We assume that multiple events can happen simultane- 
ously, but only consider closed-left, open-right intervals, as in the original system. 
Also, we consider events P and S to be exclusive in the Precedence pattern 
and inclusive in the Response pattern|^. We note, however, that it is perfectly 
possible to have formulas for all other combinations of interval bounds. Down 
edges can be substituted for up edges without changing the formulas. We have 
modified several of the 0-formulas (i.e. state-based conditions and intervals) from 
their original formulations of to remove assumptions of interleaving and make 
them consistent with the closed-left, open-right intervals. Note that in the case 
of the Universality pattern, we do not list formulas for edge-based events as 
edges cannot be universally present (by (|l|) and (||)). 

The four patterns that we did not extend are: Bounded Existence, Prece- 
dence Chain, Response Chain, Constrained Chain. While we considered 
the Bounded Existence pattern to be too convoluted to be useful in practice 



^ Two events are considered exclusive if they are not allowed to happen at the same 
time, and inclusive otherwise. 



A. Globally B. Before R C. After Q 

0. DP O.OR^{PUR) 0. D(Q^DP) 

1. DP 1. OjP^ (TPP^P) 1. D(tQ^oDP) 

D. Between Q and R E. After Q Until R 

0. D((Q A OP) ^ (PU R)) 0. D(Q ^ P W P) 

1. D((tQ A OjP A ^T^) ^ °(T-R V ^P)) 1. D(tQ ^ o(tP P ^P) < OjP > DP) 



Fig. 5. Formulations of the Universality Pattern 



0. 

1. 

2. 
3. 


A. Globally E. After Q Until R 
OP^STP 0. D(Q^ (OP^^PW((S'A^P)vP))) 
OP^STP 1. D(tQ=^o(OP^ ((^TPWP)^ (S'PP)))) 

OTP^T5PT-P 2. D(g^ (op^^T^w((T5A^T^) vP))) 
ojP ^ T5 P T-P 3. D(tQ ^ o(oP ^ ((TP P TP) ^ (T5 V TP)))) 


0. 
1. 
2. 

3. 


B. Before P C. After Q 
OP ^ (^P W ((S A ^P) V P)) 0. OQ ^ 0(Q A (OP ^ (5 P P))) 
OjP^ ((^TPWP) ^(5PP)) 1. OTQ ^ 0(TQ A o(OP^ (5 PP))) 

op^^TPW((TS'A^T-P) vP) 2. OQ ^o(QA(OTP^ (T^PTP))) 
ojp ^ ((TP P TP) ^ (TS P TP)) 3. OTQ ^ o(TQ a (otp ^ {]S v TP))) 




D. Between Q and P 

0. D((Q A OP) ^ {-^PU{{S A ^P) V P))) 

1. D((TQ A ^T^o^T-R) ^ o{{^]RUP) ^{sv P))) 

2. D((QAOP)^(^TJ'W((T5'A^Ti')VP))) 

3. D((TQ A ^\RoO]R) => o((TP P Ti?) =^ (T5 P T^)) 



Fig. 6. Formulations of the Precedence Pattern 



and thus not worth the effort of extending, the other three patterns were not 
extended for reasons that will become apparent in the next Section. 

3.2 Discussion 

What is involved in adding events to a property? Consider specifying the absence 
pattern under the "Between Q and R scope" where Q and R are (up) edges. The 
original formula is 

D{QAOR^^PUR) 

This formula docs not include P when Q and R occur simultaneously. This 
behavior is desired since the founding interval is half open and thus becomes 
empty when the two ends coincide. If we want to transform the condition and 
the interval bounds into edges, we may be tempted to use the formula: 

a{^QAO^R^^PU']R) 



A. Globally 

0. D(P^OS') 

1. D(P^OS') 

2. D(TP^OTS') 

3. D(TP^OT5') 



B. Before R 

0. OR^{P^ i^RUS)) U R 

1. Oti?^ {{P^{^]RUS))^^■\R)U(^R^{P^Q)) 

2. Oi? ^ (TP ^ h-RW TS)) W 7? 

3. OT-R ^ (T-P ^ (-T-R U]S))U 1R 



C. After Q 

0. 0(0^ □(P^os')) 

1. D(tQ^on(P^05)) 

2. □(Q^ adP ^OT^)) 

3. D(TQ^D(TP^OT5')) 



D((QAOP) => ((P^ 
n((tQAOTPA^TP) = 
n((gAOP)^((TP^ 
D((TQAOTP)^((TP 



D. Between Q and R 
-^RUS))UR)) 
■o{{{P=>{^'\RUS))A- 
{^RU]S))UR)) 
^ {-^^RU]S))U]R)) 



R 



AR)U{]Rh{P^Q)))) 



E. After Q Until 
n(g ^ (P ^ (^PW S)) W P) 

D(TQ ^ °(((P =^ hTP w S)) A ^TP) w (TP A (P : 
D(TQ^ (TP^ (^PWTS')) WP) 
D(TO ^ (TP ^ (^TPW TS)) W TP) 



Q)))) 



Fig. 7. Formulations of the Response Pattern 



However, in order to effectively express properties containing edges, we need to 



State 



Edge 

Fig. 8. Edge-detecting state 



realize that an edge is detected just before it occurs, as illustrated in Figure || 
That is, T^ becomes true in the state where A is false. 

Thus, our formula has a problem: we start testing P before the edge in Q 
because this is when we detect TQ- We need to fix this by testing P after the 
edge in Q: 

n(TQ A OTP ^ o{-^PU]R)) 



We fixed the above problem but introduced another: the new formula does not 
work correctly when "f Q and "fP occur simultaneously. This happens because we 
make sure that |i? occurs one state too early. We need to fix the antecedent by 
making sure that the interval is non-empty: 

n(Tg A -Ti? A oti? => o{^PU]R)) 

Unfortunately, the resulting formula is still incorrect: if P and ]R occur simul- 
taneously, then that occurrence of P will be ignored since |i? is detected in the 
state before the edge. This is not the intended behavior as the state before the 
edge is considered part of the interval. We need to fix it one more time: 

n(tg A -T^ A 0]R => o^{-^]RUP)) 

or better yet: 

n(tg A -t^ A 0]R =^ o(ti? V P)) 

Note that we can avoid many complications of the sort discussed above if we 
add the "previous" modality, Y. Using this new operator, we can detect edges 
just after they occur: a A -'Ya (see Figure ||). Although having the "previous" 
operator can potentially simplify a number of properties, it is currently not 
supported by SPIN. 

4 Closure Under Stuttering 

The extension of the pattern system presented in Section a, is an important 
development, and we hope that the resulting patterns provide real value to the 
end user. Still, can practitioners use our extensions directly, without worrying 
about any unexpected behavior? 

The patterns that we have created in the previous section contain the "next" 
operator. Thus, they may not be closed under stuttering. Intuitively, a formula is 
closed under stuttering when its interpretation is not modified by transitions that 
leave the system in the same state. For example, a formula Da is closed under 
stuttering because no matter how much we repeat states, we cannot change the 
value of a. On the other hand, the formula oa is not closed under stuttering. We 
can see that by considering a state sequence in which a is true in the first state 
and false in the second. Then oa is false if we evaluate it on this sequence, and 
true if we repeat the first state. 

Closure under stuttering is an essential property of temporal formulas to en- 
sure basic separation between abstraction levels and to enable powerful partial- 
order reduction algorithms utilized in mechanized checking, e.g. |^. This prop- 
erty can be easily guaranteed for a subset of LTL that does not include the 
"next" operator [Q; however, events cannot be expressed in this subset. Deter- 
mining whether an LTL formula is closed under stuttering is hard: the problem 
has been shown to be PSPACE-complete jl^. A computationally feasible algo- 
rithm which can identify a subclass of closed under stuttering formulas has been 
proposed in [Q but have not yet been implemented; without an implementation, 



one can not say how often the subclass of formulas identified by the algorithm 
is encountered in practice. Several temporal logics that try to solve the prob- 
lem have been proposed. Such logics, e.g. TLA [nol and MTL [Q, restrict the 
language so that all formulas expressed in it are, by definition, closed under 
stuttering. However, it is not clear if these languages are expressive enough for 
practical use. 

In this section we briefly present a set of theorems that allow syntactic rea- 
soning about closure under stuttering in LTL formulas and show how to apply 
them to our extensions of the pattern system. For a more complete treatment of 



closure under stuttering, please refer to |18 1 



4.1 Formal Definition 

The notation below is adopted from [^ . A sequence (or string) is a succession of 
elements joined by semicolons. For example, we write the sequence comprised of 
the first five natural numbers, in order, as 0; 1; 2; 3; 4 or, more compactly, as 0; ..5 
(note the left-closed, right-open interval). We can obtain an item of the sequence 
by subscripting: (0; 2; 4; 5)2 = 4. When the subscript is a sequence, we obtain a 
subsequence: (0; 3; 1; 5; 8; 2)i.2;3 — (0; 3; 1; 5; 8; 2)i...4 — 3; 1; 5. A state is modeled 
by a function that maps variables to their values, so the value of variable a in 
state So is So(a). We denote the set of all infinite sequences of states as stseq, 
and the set of natural numbers as N. 

We say that an LTL formula F is closed under stuttering when its interpreta- 
tion remains the same under state sequences that differ only by repeated states. 
We denote an interpretation of formula F in state sequence s as s|F], and a 
closed under stuttering formula as <C-F'^. -^F^ is formally defined as follows: 

Definition 1. <F> = Vs e stseq • Vi £ N • s|F] == (sq;..,;; Si; Si;.. 00) I-F"! 

In other words, given any state sequence s, we can repeat any of its states without 
changing the interpretation of -F. Note that so;..i', Si] Si;..oo is a sequence of states 
that differs from s only by repeating a state Si. 



4.2 Properties 

Here we present several theorems that allow syntactic reasoning about closure 
under stuttering. First, we note that J, and f can be used interchangeably when 
analyzing properties of the form 

Thus, in what follows we will only discuss the t-edge. 



We start with a few generic properties of closure under stuttering: 

{const{a) V var(a)) => <a> (4) 

<^> = <-./!> (5) 

(<A> A ■CB>) ^ <A A B> (6) 

(■CA> A <B>) ^ <A V B> (7) 

(<^> A <B>) =» <A ^ S> (8) 

<A> ^ <nA> (9) 

<A> ^ <C>A> (10) 

(<A> A «:B>) ^<^AUB:> (11) 

For example, (M)-(H) indicate that all prepositional formulas are closed under 
stuttering. The above properties do not include reasoning about formulas that 
contain the "next" operator. For those, we need the following theorem, proven 
infll: 

Theorem 1 (cus-main-thm). 

(<A> A «:B> A <C> A <!?> A <C£^> A <F>) 

<(^t^ yoByC)U [ID AoEA i^)> 

This theorem establishes an important relationship between the "next" operator, 
edges, and closure under stuttering. It gives rise to a number of corollaries that 
we found to be useful in practice. 

Property 1 

(<CA> A <B> A <C>) ^ <C>(tA A oB A C)> 

If we take i3 = T or C = T respectively, we obtain two simplified versions: 

(<A> A <B>) ^ «>(tA A B)> 

and 

(<A> A <B») ^ <0(tA A oB)> 

These formulas represent an existence property: an event ^A must happen and 
then B, evaluated before or after the event, should hold. 

Property 2 

(<CA> A <S> A «C>) =^ <n(tA ^ oB V C)> 

is similar to Property |[ Its two simplified versions are 

(<A> A «:B>) =^ <n(tA ^ B)> 

and 

(<CA> A <B>) =:> <cn(tA => oB)> 

They express a universality property: whenever an event '\A happens, B, evalu- 
ated right before or right after the event, will hold. 



4.3 Closure Under Stuttering and the Pattern System 



All properties of Figures |^[7| have been shown to be closed under stuttering. 
This was done using general rules of logic and properties identified above. For 
example, consider checking a property 

for closure under stuttering. The proof goes as follows: 

<n(tQ A -t^ A oO]R ^ o^{-^]R U P))> 

by rules of logic and LTL 

= <D(tQA-t^=^o(-(-T^W^) V-OTi?))> 

by definition of ] and rules of logic 
= <n(tQA(i?Vo^i?) ^o(^(^t^W-P) v-oti?))> 

again, by rules of logic and LTL 

= ■^U{{]Q^R^o{-^{-^]RUP)\J^O]R)))^ 

n(tQ => o{-^{-^]RUP) V -OTi? V i?))> 

distribute <C3> over the main conjunction 

^ <n((tQAi?^o(^(^T^^^)v-OTi?)))»A 

<n(tQ ^ o{-^{-^]RUP) V -^0]R V i?))» 

we can use now Property on both conjuncts 
<^ <Q> A <i?> A <-(-T^ UP)y -OTi?> A 
<Q> A <^^{-^]RUP) V -^0]R V i?> 

by rules of logic, (^) and (||) 
-^ <Q> A<i?>A<-.ti?Z^P»A«:Oti?> A 
<Q> A ■^^]RUP:> A «>ti?> A <i?> 

by Theorem ^ and Property n^ we get 
-^ <Q> A <i?> A <i?> A <P> A <i?> 

We have thus proved that 

(<P> A <Q> A <i?>) ^ <n(T(5 A -T^ A 0]R ^ o^{^]RUP)):^ 

Although the property is fairly complicated, the proof is not long, is completely 
syntactic, and each step in the proof is easy. Such a proof can potentially be 
performed by a theorem-prover with minimal help from the user. 

As we noted earlier, we did not extend all patterns to include events. The rea- 
son is that Precedence Chain, Response Chain and Constrained Chain 
were not closed under stuttering even in their state-based formulations. Consider, 
for example, the Response Chain pattern under the Global scope, formalized 
as 

U{{S A oOT) ^ oO(T A OP)) 

When we evaluate this formula on the state sequence s: 



So Si S2 ■ ■■ 

5 T _L ± ■•• 
T T _L ± ••• 
P ± _L ± ■•• 

we get T because the antecedent is always _L. However, if we stutter the first 
state So, we get the sequence so; s: 

So So Si S2 ■ 

S T T ± ±- 
T T T ± ± ■ 
P ± _L ± ± ■ 

The interpretation of the formula on this sequence is now 1. because the an- 
tecedent is T and the consequent is _L (since OP is always _L). As stuttering 
causes a change in the interpretation of the formula, we can conclude that the 
formula is not closed under stuttering. 

5 Conclusion 

In this paper we developed a concept of edges and used it to extend the pattern- 
based system of Dwyer et. al. to reasoning about events. We have also presented a 
set of theorems that enable the syntax-based analysis of a large class of formulas 
for closure under stuttering. This class includes all LTL formulas of the patterns 
that appeared in this paper. Since research shows that patterns account for 90% 
of the temporal properties that have been specified so far [0, we believe that 
our approach is highly applicable to practical problems. 

The goal of the pattern-based approach is to enable practitioners to easily 
codify complex properties into temporal logic. The extensions presented in this 
paper allow them to express events easily and effectively, without worrying about 
closure under stuttering. We hope that this work has moved us, as a community, 
one step closer to making automatic verification more widely usable. 
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A Properties of Edges 

We list a few representative properties of edges here. Their proofs appear in |ll 
[ p^ also contains a comprehensive study of the concept of edges. 
Edges are related: 



T-A = [A 


(12) 


i^A - ]A 


(13) 


I^A = IA 


(14) 


[ges interact with the boolean operators as follows: 




]{A AB) = (TA A oB) V (TS A oA) 


(15) 


T(A V B) = (tv4 A -^B) V (TS A -^A) 


(16) 


i{AAB) = (iAAB)V{iBAA) 


(17) 


1{A VB)^ (iA A o^B) V iiB A -oA) 


(18) 


[ges interact with each other: 




iiA = iA 


(19) 


iU = u 


(20) 


nA = oiA 


(21) 


nA = otA 


(22) 


Iges interact with temporal operators as follows: 




ToA = o]A 


(23) 


ioA = ojA 


(24) 


TnA = TAAoDyl 


(25) 


iaA = ± 


(26) 


10A = ± 


(27) 


lOA = iAAoO^A 


(28) 


UAUB) ^^{AvB)Ao{AUB) 


(29) 


i{AUB) =BA^o{AUB) 


(30) 



